# `swap()` will be reverted if `path` has more tokens.

UniswapSwapAdapter hardcodes output token byte offset assuming single-hop path, so multi-hop swap paths cause swap() to revert, blocking keepers from calling swapForTau().

- Payout: Contest reward
- Severity: medium
- Program: Taurus
- Credited: GimelSec
- Disclosed: 2023-02-08
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-03-taurus-judging/issues/160
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-03-taurus%3AM-1
- Tags: domain:web3 impact:dos kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:source-review vuln:dos

**Target:** UniswapSwapAdapter.sol swap() calldata parsing
**Root cause:** swapOutputToken is extracted from a fixed byte offset (length-41:length-21) that only holds for single-hop paths; multi-hop paths shift the encoded output token position, yielding a garbage address.
**Steps:**
1. Build swapData via buildUniswapSwapAdapterData with a 2-token path (single hop) and observe output token at bytes [length-41:length-21].
2. Build swapData with a 3-token path (two hops, fees [3000,3000]); encoded path length grows from 0x2b to 0x42.
3. Call swap()/swapForTau() with the multi-hop swapData; the hardcoded slice now reads wrong bytes as swapOutputToken.
4. Transaction reverts, so keepers cannot execute swapForTau().
**How found:** Code reading of the adapter's calldata slicing combined with test fixtures; noticed the hardcoded 21-byte offset only matches single-hop path encoding and verified by constructing a two-hop path.
**Insight:** When an adapter decodes ABI-encoded dynamic arrays by fixed byte offsets, test with variable-length inputs (extra path hops, longer arrays) — offsets must be computed from the encoded length field, not assumed constant.